1. Field of the Invention
This invention relates generally to conveying network control data and, more particularly, to a method and apparatus for securely conveying network control data across a cryptographic boundary.
2. Discussion of the Related Art
Networked communication systems exchange messages according to specific protocols. Most of these protocols are composed of two basic fields, known generally as control fields and data fields. The control fields are used by a sending node to indicate the network address of the destination node, and to request specific network services such as message priority, throughput requirements and type of service. The data fields on the other hand contain the actual data or messages to be exchanged between the nodes.
Since physical access to many networks cannot be controlled or monitored, encryption is often used to protect the contents of the data fields from being disclosed to an unauthorized party or an eavesdropper. However, the nature of networking protocols significantly complicates the design of highly secure network encryption devices. For example, in a network with more than two nodes, control fields typically cannot be encrypted since that would render the control fields unintelligible to the network. This prevents the network from forwarding the entire message or data packet to the appropriate destination node or address. To overcome this limitation, as well as other limitations, three techniques have been used to provide cryptographic services to network security devices.
The first technique involves bypassing the network control fields around the encryption device, thereby encrypting only the data fields. However, this technique suffers from two inherent disadvantages. First, it is possible for data fields to be bypassed (i.e., either in addition to the control fields or instead of the control fields) due to hardware or software faults. If this occurs, the bypassed data fields will be transferred over the network without the benefit of encryption. Since the data processed by such systems typically contains sensitive data (i.e., financial transactions or data supporting military operations), transmitting this data unencrypted compromises the data and thus may have very serious consequences. The second disadvantage of this method is that host devices must be implicitly trusted not to place sensitive data in control fields since that would allow the sensitive data to be released and transmitted throughout the network unencrypted, even though the bypass functioned correctly and only bypassed what appeared to be control fields. Consequently, incorporating adequate levels of trust in host devices is typically a very complex and expensive effort.
The second technique avoids the disadvantages associated with bypass methods by encrypting the entire message or data packet (i.e., control fields and data fields). However, this method can only be used to protect network messages on a link-to-link basis and cannot provide end-to-end security. In addition, all messages must be decrypted at each intermediate network switch so the control fields can be interpreted and acted upon, thereby exposing the data fields at these nodes to a possible compromise. Moreover, this technique requires complex key management to ensure that each intermediate network switch has the proper cryptographic key, which also increases the possibility that the network messages could be compromised.
The third technique eliminates the above-mentioned disadvantages by utilizing a mapping scheme based on two identical tables contained on a host processing side and a network processing side of the cryptographic boundary. By utilizing this approach, each network address or destination is associated with a unique pointer into the table. The host side thus indicates to the network side which table entry to use with this pointer. While this pointer still needs to be bypassed, the pointer does not contain any sensitive data. However, the disadvantage of this technique is that the tables must be manually created and updated, and is therefore too time consuming and inefficient when network configurations change rapidly. Additionally, this technique requires the network security devices to be off-line for a period of time in order to individually load and initialize the new tables into all network security devices used throughout the network, thereby causing interruptions in network services.
Each of the above-mentioned encryption techniques will prohibit unauthorized access to the data fields as they pass between various networks. However, each of these techniques have several drawbacks and limitations associated with their use. These drawbacks and limitations include complex and expensive network security device implementations, possibilities of transferring unencrypted data fields due to hardware or software faults, exposure of unencrypted data fields at each network switch, inefficient manual updating of mapping tables, and interruptions in network services due to the loading and initializing of new tables.
What is needed then is a method and apparatus for securely conveying network control data across a cryptographic boundary that does not suffer from the above-mentioned drawbacks and limitations. This will, in turn, reduce the cost and complexity of the network security device, eliminate the possibility of data compromises due to hardware or software faults, and allow the network security device to adaptively react to rapidly changing network configurations in a highly secure and responsive manner. It is, therefore, an object of the present invention to provide such a device.